Saleor 3.21.43 — Release Notes & Engineering Impact

- Fixed [CVE-2026-22849](https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv) - Lack of proper HTML sanitization in rich text fields - Fixed [CVE-2026-23499](https://github.com/saleor/saleor/security/advisories/GHSA-666h-2p49-pg95) - Stored XSS via Unrestricted File Uploads ## Upgrade Notes (Important) > [!NOTE] > This a security release with major changes, we recommend to read the release notes carefully. This release fixes two stored XSS vulnerabilities, if you believe you are impacted, or if you are unsure or want to verify, you should run the following commands: - CVE-2026-22849: `./manage.py clean_editorjs_fields` - this scan all rich text fields and will display any differences detected. You should look for suspicious differences (e.g., unexpected javascript code) and if you want to fix the differences, run `./manage.py clean_editorjs_fields --apply` - CVE-2026-23499: `./manage.py remove_invalid_files` - scans all uploaded files (in the media storage, e.g., the filesystem, a S3 bucket, etc.). You should look for unexpected files, if you see differences, then either: - Change the configuration so that Saleor allows the file (see the `File Uploads` section below) - Delete the file manually or automatically (`./manage.py remove_invalid_files --apply`) #### Am I impacted by the major changes? <table> <thead> <tr> <th>Question</th> <th>Answer</th> </tr> </thead> <tbody> <tr> <td>Do you use HTML attributes in EditorJS?</td> <td>If yes, you may need to look at <a href="https://docs.saleor.io/setup/configuration#editor_js_allowed_attributes">allowing custom HTML attributes</a>, and our documentation for allowing <a href="https://docs.saleor.io/setup/configuration#editor_js_allowed_attribute_values">custom attribute <strong>values</strong></a></td> </tr> <tr> <td>Do you use URL schemes other than <code>http(s)://</code>, <code>tel:</code>, and <code>mailto:</code> in EditorJS?</td> <td>If yes, look at <a href="https://docs.saleor.io/setup/configuration#unsafe_editor_js_allowed_url_schemes">our documentation for allowing custom URL schemes (<code>UNSAFE_EDITOR_JS_ALLOWED_URL_SCHEMES</code>)</a></td> </tr> <tr> <td>Do you use lists that are deeper than 10 levels? For example this is a 2 levels list: <ul><li>level 1<ul><li>level2</li></ul></li></ul></td> <td>If yes, look at <a href="https://docs.saleor.io/setup/configuration#editor_js_lists_max_depth"><code>EDITOR_JS_LISTS_MAX_DEPTH</code></a></td> </tr> <tr> <td><p>Do you use the mutations <code>fileUpload()</code> and <code>digitalContentCreate()</code>? And do you upload files in any format other than the following?</p> <ul> <li>Images: AVIF, GIF, JPEG, BMP, PNG, TIFF, WebP</li> <li>Documents: Word documents (.docx, .doc), Excel Files (.xls, .xlsx), Powerpoints (.ppt, .pptx)</li> <li>Videos: MP4, WebM, QuickTime (.mov), Vorbis (.ogg, .ogv)</li> <li>Audio: MP3, .m4a, .weba, Vorbis (.oga, .ogg), Wav (.wav)</li> <li>Text: CSV (.csv), plain text (.txt)</li> </ul> </td> <td>If yes, you may need to look at <a href="https://docs.saleor.io/setup/configuration#upload_additional_allowed_mime_types">our documentation for allowing upload of additional file formats (<code>UPLOAD_ADDITIONAL_ALLOWED_MIME_TYPES</code>)</a></td> </tr> </tbody> </table> --- Huge thanks to the security researchers who reported these issues responsibly: @vuquyen03, and @lukasz-rybak. **Full Changelog**: https://github.com/saleor/saleor/compare/3.21.42...3.21.43